L2TP over IPsec VPN - DrayTek Vigor Router to ExpressVPN
We will introduce how to create L2TP over IPsec VPN tunnel from Vigor Router to ExpressVPN server in this document.
ExpressVPN Setup
1. Create an ExpressVPN account via https://www.expressvpn.com/de and log in to your account.
2. Select VPN server and view credentials.
Visit https://www.expressvpn.com/de/setup#manual. On the right, select "PPTP & L2TP/IPsec" .
This will show you your username, password, and a list of server addresses around the world.
Keep this browser window open. You will need this information for the setup later.
Vigor-Router Setup
1. Go to VPN and Remote Access >> LAN to LAN. 
Click on an available "index" number and edit the profile as follows:
a. In Common Settings:
- Give it a profile name and Enable this profile
- Set Call Direction to Dial-Out
- Select WAN interface that the VPN will Dial-Out Through
b. In Dial-Out Settings:
- Select L2TP with IPsec Policy and Must
- Enter the VPN server IP address/ Hostname
- Enter the Username and Password
- Click on IKE Pre-Shared Key and add the "PSK"
- Select AES with Authentication as IPsec Security
c. In TCP/IP Network Settings:
- Enter Remote Network IP /Mask as 0.0.0.0/00
- Select NAT for this VPN connection
- Enable Change Default Route to this VPN tunnel option if you want all traffics to go with ExpressVPN server.
2. After finishing above settings, we can check the VPN status via VPN and Remote Access >> Connection Management page.
3. We can create Policy Route via Routing >> Load-Balance/Route Policy to define some specific traffic to go via the ExpressVPN tunnel.
In addition to ExpressVPN, VPN configuration is also possible with other VPN providers:
Note:
If you have trouble browsing websites via your ExpressVPN connection, please set the router's L2TP over IPsec MSS value to 1150 (max.) by using the telnet command "vpn mss set 4 1150".
